Lucene search
PRIOn knowledge basePRION:CVE-2023-28319HistoryMay 26, 2023 - 9:15 p.m.
Design/Logic Flaw
2023-05-2621:15:00
PRIOn knowledge base
www.prio-n.com
7
curl
vulnerability
use after free
ssh
security risk
memory
error message
heap-based data
nvd
A use after free vulnerability exists in curl <v8.1.0 in the way libcurl offers a feature to verify an SSH server’s public key using a SHA 256 hash. When this check fails, libcurl would free the memory for the fingerprint before it returns an error message containing the (now freed) hash. This flaw risks inserting sensitive heap-based data into the error message that might be shown to users or otherwise get leaked and revealed.
References
seclists.org/fulldisclosure/2023/Jul/47
seclists.org/fulldisclosure/2023/Jul/48
seclists.org/fulldisclosure/2023/Jul/52
hackerone.com/reports/1913733
security.gentoo.org/glsa/202310-12
security.netapp.com/advisory/ntap-20230609-0009/
support.apple.com/kb/HT213843
support.apple.com/kb/HT213844
support.apple.com/kb/HT213845
Related
debiancve
debiancve
CVE-2023-28319
2023-05-26 21:15:10
alpinelinux
alpinelinux
CVE-2023-28319
2023-05-26 21:15:10
osv
osv
CVE-2023-28319
2023-05-26 21:15:10
UAF in SSH sha256 fingerprint check
2023-05-17 08:00:00
redhatcve
redhatcve
CVE-2023-28319
2023-05-17 09:27:50
ubuntucve
ubuntucve
CVE-2023-28319
2023-05-17 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-28319 affecting package tensorflow for versions less than 2.16.1-1
2024-04-17 22:02:46
CVE-2023-28319 affecting package rust for versions less than 1.72.0-2
2023-10-11 01:41:59
CVE-2023-28319 affecting package curl for versions less than 8.2.1-1
2023-08-18 20:45:02
veracode
veracode
Information Disclosure
2023-06-04 09:13:01
nvd
nvd
CVE-2023-28319
2023-05-26 21:15:10
cve
cve
CVE-2023-28319
2023-05-26 21:15:10
hackerone
hackerone
Internet Bug Bounty: CVE-2023-28319: UAF in SSH sha256 fingerprint check
2023-05-23 08:38:55
curl: CVE-2023-28319: UAF in SSH sha256 fingerprint check
2023-03-21 12:05:28
cvelist
cvelist
CVE-2023-28319
2023-05-26 00:00:00
slackware
slackware
[slackware-security] curl
2023-05-17 21:00:11
nessus
nessus
openvas
openvas
Slackware: Security Advisory (SSA:2023-137-01)
2023-05-18 00:00:00
SUSE: Security Advisory (SUSE-SU-2023:2225-1)
2023-05-18 00:00:00
Mageia: Security Advisory (MGASA-2023-0263)
2023-09-25 00:00:00
freebsd
freebsd
curl -- multiple vulnerabilities
2023-03-21 00:00:00
redos
redos
ROS-20230621-04
2023-06-21 00:00:00
amazon
amazon
Medium: curl
2023-08-31 22:29:00
ibm
ibm
Security Bulletin: Multiple vulnerabilities in Curl affect PowerSC
2023-09-25 20:08:28
rosalinux
rosalinux
Advisory ROSA-SA-2024-2411
2024-05-02 09:04:51
photon
photon
Important Photon OS Security Update - PHSA-2023-3.0-0589
2023-05-31 00:00:00
Critical Photon OS Security Update - PHSA-2023-5.0-0049
2023-07-14 00:00:00
Critical Photon OS Security Update - PHSA-2023-5.0-0035
2023-06-22 00:00:00
redhat
redhat
mageia
mageia
Updated curl packages fix security vulnerability
2023-09-25 01:16:18
gentoo
gentoo
curl: Multiple Vulnerabilities
2023-10-11 00:00:00
ics
ics
Siemens TIM 1531 IRC
2024-06-13 12:00:00
Siemens SINEC NMS
2024-02-15 12:00:00
apple
apple
About the security content of macOS Big Sur 11.7.9
2023-07-24 00:00:00
About the security content of macOS Monterey 12.6.8
2023-07-24 00:00:00
About the security content of macOS Ventura 13.5
2023-07-24 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2023
2023-10-17 00:00:00